BUSINESS CONTINUITY PLAN

Transcription

1 V E R S I O N 1. 2 : J U L Y V E R S I O N 1. 2 : J U L Y 2017 BUSINESS CONTINUITY PLAN IF YOU ARE REQUIRED TO TAKE IMMEDIATE ACTION AND YOU HAVE NOT READ THIS PLAN BEFORE DO NOT READ IT NOW FIND THE RELEVENT ACTION CARD IN SECTION 4 AND FOLLOW THE INSTRUCTIONS In the event of Critical Incident alert, staff are required to remain on site and on duty until otherwise instructed

2 V E R S I O N 1. 2 : J U L Y V E R S I O N 1. 2 : J U L Y 2017 Sandwell and West Birmingham Clinical Commissioning Group BUSINESS CONTINUITY PLAN ( The Plan ) Amendment Record Sheet Version Date Amendment Author Draft 0.1 March 2015 Initial draft BounceBack Solutions October 2015 Comments on Draft Version Final from CCG Governing Body July 2015 Updates March 2016 Significant Incident changed Final 1.1 to Critical incident as defined by NHS England s EPRR Framework Nov 2015 Final 1.2 July 2017 Conversion to BCM Plan only due to Introduction of the West Midlands Conurbation CCG Incident Response & Recovery Plan and BCM Incident level definitions BounceBack Solutions BounceBack Solutions BounceBack Solutions

3 V E R S I O N 1. 2 : J U L Y V E R S I O N 1. 2 : J U L Y 2017

4 V E R S I O N 1. 2 : J U L Y V E R S I O N 1. 2 : J U L Y 2017 Contents 1 PLAN OVERVIEW Purpose Objectives Scope Within Scope Out of Scope Assumptions Ownership CCG Plan Supplier/Contractor Plans Definitions Business Continuity Incident Levels Critical Services Essential Services Routine Services The Plan NHS England Command and Control Framework Training Exercising Communications Exercise Tabletop Exercise Command Post Exercise Live Exercise Review Date BUSINESS CONTINUITY PLANNING Introduction Business Impact Analyses Business Disruption Risk Assessments Developing Plans Departmental Planning Directorate Planning... 10

5 V E R S I O N 1. 2 : J U L Y V E R S I O N 1. 2 : J U L Y CCG-wide Strategic Planning Testing and Exercising INITIAL NOTIFICATION AND ASSESSMENT Introduction Incident Reporting Report It! Role of the Notifying Manager Incident Report Forms and Incident Risk Assessments Escalation On-call Director / In hours Designate Role of the Business Continuity Management Group Record Keeping / Logging Action Cards CRITICAL INCIDENT RESPONSE Activation Command and Control Arrangements Business Continuity Management Group (BCMG) Convening the BCMG Purpose of the BCMG Considerations for the BCMG Critical Incident Declaration Normal Business CCG Critical Incident in Standby CCG Critical Incident in Response Business Continuity Management Response Team (BCMRT) Incident Control Rooms Making use of Available Resources EPRR Documentation Folder On-Call Rotas Equipment Instructions Contact Lists Documentation and Logging Communications... 25

6 V E R S I O N 1. 2 : J U L Y V E R S I O N 1. 2 : J U L Y Communicating with Staff Managing Stakeholders Working with the Media Stand Down Debrief STAFF ACTION CARDS Incident assessment guidelines Incident escalation process CCG Critical Incident Command and Control Structure Notifying Manager CCG On-call Director / In Hours Designate Accountable Emergency Officer / Nominated Deputy Incident Director Incident Control Room Manager Decision Loggist General Loggist Minute Taker and Administrative Support CCG Directorate Director Communications and Media Advisor Estates and Facilities Advisor Finance Advisor Human Resources and Workforce Advisor IT and Telecommunications Advisor Legal Advisor Technical Support IT and Telecomms Staff involved in Directorate response FORMS AND TEMPLATES Incident Report Form Incident Risk Assessment Template Standard First Agenda for Business Continuity Management Group (BCMG) Emergency Personal Log Book Directorate Impact Assessment Template ANNEXES Annex 1: CCG Business Continuity Management (BCM) Policy Annex 2: CCG Aggregated Business Impact Analysis (BIA)... 66

7 V E R S I O N 1. 2 : J U L Y V E R S I O N 1. 2 : J U L Y 2017 Annex 3: CCG Aggregated Business Disruption Risk Assessment Annex 4: Trust Business Continuity and Emergency Preparedness Training Schedule... 66

8 1 : P L A N O V E R V I E W 1 : P L A N O V E R V I E W 1 PLAN OVERVIEW 1.1 Purpose This document provides the Business Continuity Management (BCM) arrangements for Sandwell and West Birmingham Clinical Commissioning Group. These arrangements have been developed in accordance with Department of Health / NHS England National Guidance and the relevant standards PAS 2015:2010 and ISO The function of the Plan is to mitigate the effects of any business continuity incident, which affects the operation of normal business within Sandwell and West Birmingham Commissioning Group, particularly in terms of prioritising business critical functions and in responding to the challenge. Sandwell and West Birmingham CCG will be referred to as the CCG for the remainder of this plan. 1.2 Objectives The objectives of the CCG s Plan are to: Provide a strategic framework for the CCG's response to and recovery from incidents, underpinned by appropriate Directorate and supplier/contractor planning; Provide clear command and control arrangements for a range of incidents varying in scales and complexities; Identify those who must be notified and kept informed internally of the disruptive challenge affecting normal business; Enable sufficient flexibility to cater for losses of varying scale or where only specific elements may be required; Identify business risks, plus critical, essential and routine services and define alternative procedures; Identify additional short term resources required for supporting partial operation; Provide a framework for the timely and orderly recovery of the business. 1.3 Scope Within Scope This plan relates to the business continuity management of the business functions that have been identified as part of the Business Impact Analysis that has been carried out by each directorate of the CCG (See Annex 2). Version 1.2 July 2017 Page 1

9 1 : P L A N O V E R V I E W 1 : P L A N O V E R V I E W This plan will also outline the arrangements for managing and overseeing business continuity management of the CCG s suppliers and contractors Out of Scope This plan specifically excludes services commissioned by the CCG on behalf of the community. This plan will not outline the arrangements for business continuity management of services and business functions carried out by the CCG s providers. These arrangements will be detailed within provider business continuity plans. Assurance of such arrangements will sought through the Local Health Resilience Partnership via provider s NHS England Core Standards for Emergency Preparedness, Resilience and Response 2016/17 self assessments and through standard contract management as detailed within the NHS Standard Contract Service Conditions arrangements. Similarly this plan will not address management of capacity and patient flow. Arrangements for capacity and patient flow are detailed with A&E Delivery Board Plans and Regional Capacity Management Team Support. In addition, this plan specifically excludes Major Incidents declared by the NHS. The arrangements for managing Major Incidents are detailed within the West Midlands Conurbation CCGs Incident Response and Recovery Plan in partnership with NHS England, West Midlands Incident Response Plan. 1.4 Assumptions A number of assumptions have been made in the creation of this document: The plan details the arrangements for the CCG and includes all staff employed directly within any of its Directorates or any known visitors meeting CCG premises staff on the day of an incident; The plan has the full support of the Governing Body of the CCG who will ensure full cooperation from each Directorate; The plan will be regularly reviewed, including through a number of trigger mechanisms to ensure it is fit for purpose; The plan will be regularly validated through training and exercising; and; Directorate Departments have participated in the compilation of the Business Impact Analyses (BIA) to provide an understanding of business critical functions. 1.5 Ownership CCG Plan Version 1.2 July 2017 Page 2

10 1 : P L A N O V E R V I E W 1 : P L A N O V E R V I E W This plan is jointly owned by the Accountable Emergency Officer of the CCG, who delegates responsibility to the Chief Operating Officer, Transformation. Hard copies of this Plan will be stored in: ICC Room (4R Meeting Room 1) Additional digital copies of this plan will be made available to Directors, Directorate and supplier/contractor Business Continuity Leads and Department Managers. Electronic copies of this Plan will be stored in: On Call Directors Pack (Office 365) Supplier/Contractor Plans The Business Continuity Plans of suppliers and contractors which underpin this Plan are owned by the respective suppliers and contractors. Contractual standards and assurances sought should be fully compliant with the expectations placed upon the CCG in the NHS England Core Standards for Emergency Preparedness, Resilience and Response 2015/16 and as outlined within the NHS Standard Contract Service Conditions arrangements. 1.6 Definitions Business Continuity Incident Levels For the purposes of this plan, three levels business continuity Incident definitions: Minor Significant Critical Incident Standby / Response For criteria and detail for each of the above incident levels, please refer to Figure 1, Page Critical Services A critical service is defined as a service in which the maximum tolerable period of disruption is less than twenty-four hours Essential Services Version 1.2 July 2017 Page 3

11 1 : P L A N O V E R V I E W 1 : P L A N O V E R V I E W An essential service is defined as a service in which the maximum tolerable period of disruption is more than twenty-four hours but less than forty-eight hours Routine Services A routine service is defined as a service in which the maximum tolerable period of disruption is greater than forty-eight hours The Plan Refers to the CCG Business Continuity Plan, which should be read in conjunction with respective Directorate Business Continuity Plans. 1.7 NHS England Command and Control Framework This Plan has been developed to reflect arrangements outlined in NHS England s Emergency Preparedness, Resilience and Response Framework 2015 developed for NHS England and which may be invoked in the event of a major / critical incident requiring a coordinated NHS response by one or more NHS organisations. 1.8 Training Training staff on the Business Continuity arrangements detailed within this Plan will be delivered through a variety of means including: Ad-hoc meetings with Directorate and Department staff within the CCG; Departmental or one-to-one sessions with staff completing departmental documentation and pro-formas; and Awareness and training events. Training Schedule can be seen at Annex 4 of this plan. 1.9 Exercising Plans developed to allow all NHS organisations to respond efficiently and effectively, must be tested regularly using a table-top and live exercises, or through any other recognised and agreed process. Roles within the plan (not individuals) are exercised to ensure any specific role is fit for purpose and encapsulates all necessary functions and actions to be carried out during an incident. The outcome of testing and exercising must identify and log, did it work and what needs changing? The log must also identify what has changed. This information provides an audit tool that lessons have been learnt and is also key information during any inquiry process. Version 1.2 July 2017 Page 4

12 1 : P L A N O V E R V I E W 1 : P L A N O V E R V I E W Through the exercising process, individuals have the opportunity to practice their skills and increase their confidence, knowledge and skill base in preparation for responding at the time of a real incident. Exercises should not be conducted solely as a single agency event but should reflect the identified risks and the involvement of commissioners and co-responders as appropriate. Learning from exercises must be cultivated into developing a method that supports personnel and organisational goals and is part of an annual plan validation and maintenance programme. Each NHS funded organisation is required to undertake the following: Communications Exercise These exercises are required to be undertaken every 6 months. These are to test the ability of the organisation to contact key staff and other NHS and partner organisations 24/7. These could include testing paging services as well as telephone and systems. These unannounced exercises should be tested both in and out of office hours on a rotational basis Tabletop Exercise These exercises are required to be undertaken every 12 months. These are exercises where relevant staff and partner agencies are brought together to discuss the response to a Critical incident, emergency, within the same room. These exercises work through a particular scenario and can provide validation to plans. Participants are able to interact and gain knowledge of other agencies/organisations roles and responsibilities generating levels of realism Command Post Exercise These exercises are required to be undertaken every three months. This type of exercise will test the operational element of command and control and requires the setting up of the Incident Coordination Centre (ICC). This provides a practical test of equipment, telephone and IT facilities and provides familiarity to those undertaking roles within the ICC. This can be incorporated into communications or live exercise; In conjunction with local command post exercises (CPXs), NHS organisations should also test their links with their multi-agency partners incident coordination centres. All agencies/organisations should be positioned at ICCs as they would be in a real incident. These test communication arrangements and the flow of information up and down the chain of command; and if an organisation has had reason to activate their ICC for a real incident then this supersedes the need to run an exercise, providing lessons identified are captured and developed. Version 1.2 July 2017 Page 5

13 1 : P L A N O V E R V I E W 1 : P L A N O V E R V I E W Live Exercise These exercises are required to be undertaken every three years. These are a live test of arrangement and include the operational and practical element of emergency response. This could include simulated casualties being brought to an Emergency Department or the setting up of a mass countermeasure centre. These are very useful in validating operational aspects of an incident response plan. If an organisation has had reason to activate their plan for a real incident then this supersedes the need to run an exercise, providing lessons identified are captured and developed; and under interoperability there is an expectation that NHS organisations will actively participate with exercises run by multiagency partners including the LRF where relevant to health. NHS funded organisations are required to share information of lessons identified and learnt from training, exercising, emergency or Critical incidents, across the wider NHS through a common process and co-ordinated through the LHRP strategic groups. Working collaboratively will improve organisational cohesion, ensure our patients and public are safeguarded during a crisis such as an emergency or Critical incident Review Date The CCG Plan should be reviewed at a minimum: When there are changes to the organisational structure; When the purpose or role of the organisation changes; Following an incident; or, Annually.. Version 1.2 July 2017 Page 6

14 2 : B U S I N E S S C O N T I N U I T Y P L A N N I N G 2 : B U S I N E S S C O N T I N U I T Y P L A N N I N G 2 BUSINESS CONTINUITY PLANNING 2.1 Introduction This Section provides an overview of how the CCG staff should plan and prepare for an incident that could cause disruption to its business activities. This is a summary only; full details are contained within both organisations Business Continuity Management Policies and can be found at Annex 1 of this Plan. 2.2 Business Impact Analyses Responding effectively to a Business Continuity incident is underpinned by a sound understanding of the business. This understanding includes: What the organisation does; What its priorities are; and What is required to deliver these priorities. This understanding is achieved through undertaking a Business Impact Analysis (BIA). Templates have been developed to assist staff in creating their Business Impact Analyses. These can be found in the Business Continuity Management (BCM) Toolkit which is obtainable from the relevant Directorate Business Continuity Lead and which also appears as part of Annex 1 of this Plan It is recommended that before starting work on a BIA staff should: Read through the BCM Toolkit; and Seek advice as necessary from the relevant Directorate Business Continuity Lead. 2.3 Business Disruption Risk Assessments BCM Plans should be developed as part of the planning process and should be based on well-informed risks if they are to be appropriate and proportionate. A Business Disruption Risk Assessment (BDRA) is the product of both the likelihood and impact of an event or incident taking place. BDRAs should be undertaken at a Directorate level. Templates for completing BDRAs can be found in the BCM Toolkit which can be obtained from the relevant Directorate Business Continuity Lead and which also appears as part of Annex 1 of this Plan Version 1.2 July 2017 Page 7

15 2 : B U S I N E S S C O N T I N U I T Y P L A N N I N G 2 : B U S I N E S S C O N T I N U I T Y P L A N N I N G. It is recommended that before starting work on a BDRA staff should: Read through the BCM Toolkit; and Seek advice as necessary from the relevant Directorate Business Continuity Lead. Risk Assessments are notoriously subjective. For this reason it is essential that relevant staff involve: Other members of the Department / Directorate; and Research risks that have been calculated from organisational Risk Assessments, Community Risk Registers and National Risk Registers. These can be obtained via the relevant Directorate Business Continuity Lead. 2.4 Developing Plans Developing BCM Plans enables staff and managers to prepare and respond more effectively to incidents. The continuation of services can be affected by any number of incidents that may differ in terms of size, scope, cause and effect. To respond to this, the CCG has three levels of planning which is undertaken on a regular basis: 1. Departmental Planning; 2. Directorate Planning; and 3. CCG-wide, Strategic Planning. Figure 1 below illustrates some of the potential incident triggers for deciding which level of planning is most appropriate to implement in response to an incident: Version 1.2 July 2017 Page 8

16 2 : B U S I N E S S C O N T I N U I T Y P L A N N I N G 2 : B U S I N E S S C O N T I N U I T Y P L A N N I N G Figure 1: Incident Assessment Criteria Minor Business Continuity Incident Involves one Team/Department only and or Minor risk(s) e.g. criticality of service and/or Has little or no political/media interest and/or Incident is contained and can be managed using existing resources Managed through focussed application of day-to-day arrangements and resources Refer to appropriate CCG policies and if necessary to the relevant Team / Departmental detail contained within this Plan (See section 2.41) Significant Business Continuity Incident Involves one Directorate only and/or Significant risk(s) e.g. criticality of service and/or Significant local political/media interest and/or Incident can be managed with coordination of existing resources Managed through activation of appropriate Directorate Business Continuity Plan(s) Refer to appropriate CCG policies and to the relevant Directorate detail contained within this Plan (See Section 2.42) Critical Incident Standby / Response Involves more than one Directorate/has a CCG-wide organisational impact or beyond and/or Critical risk(s) e.g. criticality of service and/or Widespread political/media interest and/or Incident may require widespread coordination of existing resources and potential requirement for additional resources Managed through activation of the CCG-wide Business Continuity Plan or NHS England West Midlands Incident Response Plan as appropriate. Refer to appropriate CCG policies and to CCG-wide detail contained within this Plan (See Section 4) This is a guideline only. Each incident is dynamic and must be assessed and dealt with appropriately and proportionately on a case-by-case basis through the appropriate Impact and Risk Assessments. Escalation and de-escalation through the levels above can also take place as appropriate during the evolution and on-going management of an incident. Version 1.2 July 2017 Page 9

17 2 : B U S I N E S S C O N T I N U I T Y P L A N N I N G 2 : B U S I N E S S C O N T I N U I T Y P L A N N I N G Departmental Planning Departmental business continuity arrangements are included as part of the respective Directorate Plans to which the Department belongs. They include localised information including: Staff contact details; Business Impact Analyses to support decision making on service prioritisation during an incident; Business Disruption Risk Assessments for likely causes of service disruption; and Annual Action Plans to improve departmental resilience. Department Managers are responsible for ensuring that: Effective plans are in place to respond to a range of incidents; Considerations are made based on the agreed criticality of Departmental processes; Staff are made aware of an incident; Arrangements are made to ensure the continuation of critical Departmental processes; and The Director is consulted as necessary when processes are either reduced or stopped altogether. It is important that when developing departmental arrangements staff consult their Directorate Business Continuity Lead Directorate Planning There are six (6) individual Directorate Business Continuity Plans for: Finance HR / OD Operations Partnerships Quality Safeguarding Each Plan consists of: Command and control arrangements for managing an incident for that specific Directorate; Individual Departmental Plans for the Directorate; and Specific planning arrangements for particular risks at a Directorate Level. Directorate Directors are responsible for ensuring that: Version 1.2 July 2017 Page 10

18 2 : B U S I N E S S C O N T I N U I T Y P L A N N I N G 2 : B U S I N E S S C O N T I N U I T Y P L A N N I N G Effective plans are in place to respond to a range of incidents across all Departments; Considerations are made based on the criticality of processes across Departments; An effective communication system is in place to communicate with Managers; and Each Directorate should have a nominated Business Continuity Lead to champion business continuity planning within Directorates CCG-wide Strategic Planning CCG-wide strategic planning arrangements can be found within this plan as part of Section 4. A strategic response is most likely to be activated when: An incident affects organisational processes within more than one Directorate; An incident affects one or more critical service area When there is political interest in the incident; and/or When there is media interest in the incident. Strategic planning enables plans to be developed for risks that could impact across the organisation and provides direction for Directors and Department Managers. 2.5 Testing and Exercising Once plans have been developed it is important that they are tested and exercised on a regular basis. Testing and exercising enables plans to be validated and weaknesses found but in a safe and controlled environment. Arrangements to develop appropriate tests/exercises can be done with the support of the Emergency Planning and Business Continuity Officer. Version 1.2 July 2017 Page 11

19 3 : N O T I F I C A T I O N A N D A S S E S S M E N T 3 : N O T I F I C A T I O N A N D A S S E S S M E N T 3 INITIAL NOTIFICATION AND ASSESSMENT 3.1 Introduction This section should be utilised during the initial stages of an incident. Its purpose is to: 1. Assist those directly involved in the incident to ensure the appropriate reporting mechanisms are applied; 2. Guide the initial incident manager through escalating the incident to the appropriate level; and 3. Ensure the appropriate plans are activated and due diligence completed as required. 3.2 Incident Reporting Any incident should be reported appropriately. For a potential business continuity incident you should ask yourself the following questions: 1. Has the incident triggered or is it likely to trigger negative outcomes? 2. Will these outcomes affect service delivery? 3. Will managing this event at a local level exceed the limit of what can be done with resources available? If you answer yes to any of these questions then you must Report It using the following process Report It! The person who receives notification of a potential business continuity incident could be anyone within the CCG and it could be from a variety of sources. If you receive a message from a caller about a potential business continuity incident: Confirm the caller s details: o Name o Organisation o Contact telephone number Confirm details of the incident: o Exact location of the incident? o Which Team(s)/Department(s) are currently involved? o Which Directorate(s) are currently involved? o Are there any hazards to patients, staff, responders or to members of the public? Version 1.2 July 2017 Page 12

20 3 : N O T I F I C A T I O N A N D A S S E S S M E N T 3 : N O T I F I C A T I O N A N D A S S E S S M E N T o Have any external agencies (e.g. emergency services, other NHS organisations) been notified? o Any other relevant information? There could also be more than one telephone call about the same incident but giving different details so it is important that a correct record is taken of all telephone calls both received and made. The most senior member of staff at the location of the incident is responsible for the ensuring initial reporting of the incident. Reporting of the incident should be made to the relevant Departmental Manager in the first instance. In the event of the local Departmental Manager being unavailable you should alert the Deputy Manager or nearest alternative Departmental Manager. When reporting the incident it is essential that the right information is communicated. This should be done in a calm and clear manner. All staff need to know what to do. All staff must be notified of the way to deal with calls regarding incidents and how they should be transferred, including temporary staff, especially anyone covering the main switchboard. 3.3 Role of the Notifying Manager The Notifying Manager is the Departmental Manager advised of the incident. They are therefore responsible for evaluating and escalating the incident through the CCG's management hierarchy (in Hours) or CCG on-call arrangements (Out of hours) if required. An Action Card for use by all appropriate CCG staff in this role can be found at Page 32, Section 5 of this Plan 3.4 Incident Report Forms and Incident Risk Assessments The Notifying Manager should complete an Incident Report Form (See Page 55) based on the information available at the time. Members of staff within the CCG (and the wider Health Economy where appropriate) should be called upon as appropriate to assist in understanding the impact of the incident. Each risk identified should be fully recorded and evaluated using the Risk Assessment Template (See Page 58). The notifying manager should complete further Incident Report Form(s) if subsequent updates are required, ensuring that revised / updated / additional Risk Assessment Templates are completed to ensure that the pattern of risk and mitigating measures are fully catalogued for the duration of the incident It is at the discretion of the notifying manager to decide the duration of time spent on completing the Incident Report Form. In larger incidents it will be Version 1.2 July 2017 Page 13

21 3 : N O T I F I C A T I O N A N D A S S E S S M E N T 3 : N O T I F I C A T I O N A N D A S S E S S M E N T clear from the outset that escalation is required and if this is the case the Form should be completed promptly. The aims of completing initial and any follow-on Incident Report Forms are to: 1. Collate the available information on what precisely has happened; 2. Determine as far as possible at the time the outcomes or likely outcomes of the incident; and 3. Assess the extent to which the CCG or the wider Health Economy has been or is likely to be affected: a. The service areas within the CCG and/or the Health Economy; and b. The named Departments/Directorate(s) affected within the CCG. A template for the Incident Report Form and Incident Risk Assessment Template can be found in Section 6, Pages 55 and 58 of this Plan. 3.5 Escalation Following the completion of the Initial Incident Report Form, the Notifying Manager must decide whether it is appropriate to escalate to a more senior level via: In hours: Normal channels of communication in the first instance Out of Hours: The CCG's 24-hour on-call arrangements by requesting the CCG On call Director via: SWBH switchboard To assist with making this decision, the manager should utilise the Escalation Assessment Flowchart at Figure 1 below. Basic guidance on appropriate levels of escalation can be found in Figure 2 below. These diagrams can also be found in Section 6 of this Plan. If as the outcome of this assessment escalation is not required, the Notifying Manager should work alongside those involved to manage the incident at a local level and ensure that actions and decisions are logged appropriately including recording on the DATIX incident reporting system. Version 1.2 July 2017 Page 14

22 3 : N O T I F I C A T I O N A N D A S S E S S M E N T 3 : N O T I F I C A T I O N A N D A S S E S S M E N T Figure 1: Incident assessment guidelines Minor Business Continuity Incident Involves one Team/Department only and or Minor risk(s) e.g. criticality of service and/or Has little or no political/media interest and/or Incident is contained and can be managed using existing resources Managed through focussed application of day-to-day arrangements and resources Refer to appropriate CCG policies and if necessary to the relevant Team / Departmental detail contained within this Plan (See section 2.41) Significant Business Continuity Incident Involves one Directorate only and/or Significant risk(s) e.g. criticality of service and/or Significant local political/media interest and/or Incident can be managed with coordination of existing resources Managed through activation of appropriate Directorate Business Continuity Plan(s) Refer to appropriate CCG policies and to the relevant Directorate detail contained within this Plan (See Section 2.42) Critical Incident Standby / Response Involves more than one Directorate/has a CCG-wide organisational impact or beyond and/or Critical risk(s) e.g. criticality of service and/or Widespread political/media interest and/or Incident may require widespread coordination of existing resources and potential requirement for additional resources Managed through activation of the CCG-wide Business Continuity Plan or NHS England West Midlands Incident Response Plan as appropriate. Refer to appropriate CCG policies and to CCG-wide detail contained within this Plan (See Section 4) This is a guideline only. Each incident is dynamic and must be assessed and dealt with appropriately and proportionately on a case-by-case basis through the appropriate Impact and Risk Assessments. Escalation and de-escalation through the levels above can also take place as appropriate during the evolution and on-going management of an incident. Version 1.2 July 2017 Page 15

23 3 : N O T I F I C A T I O N A N D A S S E S S M E N T 3 : N O T I F I C A T I O N A N D A S S E S S M E N T Figure 2: Incident escalation process INCIDENT OCCURS Confirm available details Department Manager (Notifying Manager) Minor Business Continuity Incident Significant Business Continuity Incident In-Hours Normal channels of communication should be used in the first instance. Out of Hours Contact the Black Country CCG Director On Call Via: SWBH switchboard Critical Incident Stanby /Response Accountable Emergency Officer NHS England West Midlands 1 st Oncall Incident Manager via: First Response Tel NHS England West Midlands Incident Response Plan Level 1 BUSINESS CONTINUITY MANAGEMENT GROUP (BCM GROUP) BUSINESS CONTINUITY MANAGEMENT RESPONSE TEAM (BCMRT) Consider NHS England West Midlands Incident Response Plan Levels 2-4 Version 1.2 July 2017 Page 16

24 3 : N O T I F I C A T I O N A N D A S S E S S M E N T 3 : N O T I F I C A T I O N A N D A S S E S S M E N T 3.6 On-call Director / In hours Designate An On-call Director / In Hours Designate Action Card can be found at Page 34 Section 5 of this Plan. The On-call Director / In Hours Designate should complete their own initial and any follow-on Incident Report Forms and Risk Assessment Templates included in On-call Director Pack (and which can also be found at Pages 55 and 58 respectively Section 6 of this Plan). The On-call Director / In Hours Designate should in turn: Assess the current situation, based on the information available from the Notifying Manager Advise the Notifying Manager of any appropriate steps to take, both to manage the incident itself and to mitigate service disruption Act as dictated by the situation, including: i. Arranging with the Notifying Manager future updates if the situation is unclear or an evolving one. ii. Contacting the relevant Director (within the CCG) and/ or the Accountable Emergency Officer iii. Taking strategic oversight of the next steps in the CCG s incident management. If necessary, this will include overseeing the convening, physically or virtually, of the CCG's Business Continuity Management Group to take a collective decision regarding next steps. 3.7 Role of the Business Continuity Management Group The BCMG, composed of the CCG's Accountable Emergency Officer, Directorate Directors will meet if required, physically or virtually, with the intention of formally declaring the level of incident: 1. No declaration made 2. Declaring either a minor or significant incident 3. Declaring a Critical Incident / Standby or Response In the event of an Critical Inicdent being declared the BCMG will determine: 1. The Business Continuity Management Response Team (BCMRT) which will be responsible for providing the tactical response to the incident; and 2. Which Plan(s) and policies to utilise to assist in the response to the incident. The CCG has several Plans, which have been developed to respond to its most significant risks. These include: Version 1.2 July 2017 Page 17

25 3 : N O T I F I C A T I O N A N D A S S E S S M E N T 3 : N O T I F I C A T I O N A N D A S S E S S M E N T CCG Business Continuity Plan; West Midlands Conurbation CCGs Incident Response & Recovery Plan; and NHS England, West Midlands Incident Response Plan. These plans can be found in the Emergency Planning Documentation Folder which is stored with members of the BCMGMG, the CCG Incident Control Rooms. Electronic copies of Plans can be found in: Add hyperlinks to finalised locations The CCG's response will also be determined throughout by reference to its existing suite of policies and procedures. 3.8 Record Keeping / Logging It is essential that members of the CCG that are responsible for making decisions log their actions/decisions. A full description of recording keeping and logging can be found at Section 4.8 (Page 24) of this plan. 3.9 Action Cards A full suite of Action Cards has been developed to support the response arrangements detailed in this Section. These can be found in Section 5 of this Plan. Version 1.2 July 2017 Page 18

26 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4 CRITICAL INCIDENT RESPONSE 4.1 Activation Critical Incident response means a strategic, CCG -wide response to a Business Continuity Incident. Critical Incident response is achieved in the first instance through the activation and operation of the Business Continuity Management Group (BCMG). The BCMG is activated at the discretion of the CCG On-call Director / In Hours Designate in consultation with the Accountable Emergency Officer. 4.2 Command and Control Arrangements In the event of a Critical Incident, the CCG operates a three-tier command and control structure as illustrated by the diagram below: Business Continuity Management Group (BCMG) STRATEGIC - GOLD Business Continuity Management Response Team (BCMRT) TACTICAL - SILVER Directorate / Department /Service Level OPERATIONAL - BRONZE Version 1.2 July 2017 Page 19

27 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4.3 Business Continuity Management Group (BCMG) The aim of the BCMG is to provide strategic direction to CCG Directorates to enable an appropriate response to an incident which brings disruption to service delivery of a nature and/or magnitude which requires CCG-wide resource coordination. The BCMG may be responsible for the development of assurance reports to the Governing Body in some incidents. Membership of the BCMG comprises: i. CCG Accountable Emergency Officer or nominated deputy (Chair) ii. CCG executive directors / senior managers The BCMG should be attended at all times by a minute taker, decision loggist and general loggist Convening the BCMG If the outcome of consultation between the CCG On-call Director / In Hours Designate and the Accountable Emergency Officer is to convene the BCMG The On-call Director / In Hours Designate is responsible for convening the BCMG. The On-call Director / In Hours Designate may delegate the bringing together of the BCMG to another member of the organisation as appropriate. The CCG On-call Director / In Hours Designate will select the most appropriate location for the BCMG to convene either physically or virtually. The CCG On-call Director / In Hours Designate should use the Agenda Template at Page 59 in Section 6 of this Plan to organise the meeting of the BCMG. NB: The On-call Director / In Hours Designate may wish to amend the template to reflect any specifics regarding the type of incident Purpose of the BCMG The purpose of the BCMG is to: Obtain a full brief of the incident; Discuss the primary and emerging risks arising from the incident; Officially declare if there is a critical incident; and Set up the required structures and assign the resources to support the response Considerations for the BCMG In order for the BCMG to reach an informed decision, the BCMG should ensure that at a minimum, the following is considered: The scale of the incident and likely duration Version 1.2 July 2017 Page 20

28 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4 : C R I T I C A L I N C I D E N T R E S P O N S E The criticality of the services already affected and/or those likely to be affected The anticipated CCG resource requirements from within (and potentially from outside) needed to deal with the incident Is there need for the incident control room to be made operational? What communications should be developed (if any) to: o CCG staff o NHS England West Midlands o Healthcare Providers o The relevant local authority Is there / likely to be media interest in the incident? Is there / likely to be political interest in the incident? Do you need more information? If so, where can this be obtained and who is responsible for finding it? 4.4 Critical Incident Declaration On discussing the considerations laid out in Section above the BCMG should declare CCG as either: CCG Critical Incident in Standby (internally and externally to NHS England West Midlands 1 st On-call Incident Manager) CCG Critical Incident in Response (internally and externally to NHS England West Midlands 1 st On-call - Incident Manager) Normal Business If no cincident is declared then the minutes of the BCMG should be discussed at the next meeting of the CCG s Quality and Safety Committee. This will enable the Quality and Safety Committee to discuss why the BCMG was convened and if the action taken was appropriate given the available evidence at the time the BCMG was convened. Outcomes from this discussion should be used to ascertain any training needs for staff within the organisation CCG Critical Incident in Standby The CCG may declare a Critical Incident in Standby during incidents which have the potential to develop/worsen over a period of time, for example during the early stages of an outbreak or pandemic flu. In the event that the BCMG declares Standby, the BCMG should: Put in place a timetable for reviewing the declaration on a regular basis. Appoint an Incident Director; and Version 1.2 July 2017 Page 21

29 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4 : C R I T I C A L I N C I D E N T R E S P O N S E Begin to prepare for a Critical Incident (i.e. set up the Incident Control Room(s)). The extent of these preparations will depend on the type of incident CCG Critical Incident in Response In the event that a Critical Incident is declared the following actions should be taken by the BCMG: Establish a Business Continuity Management Response Team (BCMRT), including Incident Director (See Section 4.5 below) and distribute Action Cards (See Section 5). Develop a proportionate response. Set up the Incident Control Room(s) as appropriate Obtain through exception reporting assurances from CCG Directorates that all critical services are maintained through Directorate Impact Assessments based on evaluation of relevant Business Impact Analyses (BIAs); Obtain through exception reporting assurances from Directorates that all essential services, if disrupted will be operational within 48hrs through Directorate Impact Assessments informed by relevant BIAs; Obtain through exception reporting assurances from CCG Directorates that all routine services, if disrupted will be operational within 2 weeks or longer if the Recovery Time Objective detailed within Business Impact Analyses permits through Directorate Impact Assessments informed by BIAs; Coordinate cross-directorate staff allocation. Situations where this may be necessary include where there is widespread staff absence but this is isolated to a single Directorate or part of a building where people work; Providing strategic direction to the impacts raised in Directorate Impact Assessments; Ensuring the on-going wellbeing of staff; Ensure each of the above processes has the appropriate governance arrangements including where appropriate appointed loggists and documentation (See Section 4.8 below). 4.5 Business Continuity Management Response Team (BCMRT) On declaring a Critical Incident (or standing by for one of these), the appointed Incident Director should develop a Business Continuity Response Team (BCMRT). The BCMRT will be response for determining and delivering the CCG's tactical response to the incident and will be based in its Incident Control Room (ICR) Version 1.2 July 2017 Page 22

30 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4 : C R I T I C A L I N C I D E N T R E S P O N S E The team that is convened will likely change over time and as the incident develops. The size of the response team and the roles that are included within the team will likely be different depending on the nature of the incident. In deciding the composition of the response team, the Incident Director should consider the following: Specific expertise that will be required and both the CCG Directorates/Departments which will be able to provide this; Roles within the organisation who have good contacts / networks internal and external to the organisation; and Administrative roles that will be required to support the response team, including note takers, minute takers and loggists. It is vital that when convening a response team the Incident Director ensures members of the Team have nominated appropriate deputies who can take over should it be required. These deputies should be updated on progress at regular intervals to ensure they have the required context/information should they need to take on the role. Action Cards for members of the BCMRT can be found at Section 5 of this Plan. Dependent upon the nature and scale of an incident, one individual may be required to undertake more than one role, whilst in some circumstances it may be appropriate to dispense with certain roles altogether. Details of those who might be called upon to join the BCMRT are held centrally by the CCG On-call Director / In Hours Designate. 4.6 Incident Control Rooms The CCG has two facilities, which can quickly be setup to be used as Incident Control Room for use by the BCMRT: Ground floor meeting room Kingston House Cross City CCG Bartholomew House 4.7 Making use of Available Resources EPRR Documentation Folder Members of the BCMG and likely members of a BCMRT have a folder containing paper copies of the key emergency plans. These are updated no less than annually and include: CCG Business Continuity Plan West Midlands Conurbation CCGs Incident Response & Recovery Plan; and Version 1.2 July 2017 Page 23

31 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4 : C R I T I C A L I N C I D E N T R E S P O N S E NHS England West Midlands Incident Response Plan There is additional room for extra documents including on-call rotas and local departmental or directorate business continuity plans. Responsibility and ownership of any additional documents stored within this folder lie with the folder owner On-Call Rotas The CCG On-call Director on-call rotas are available by telephoning SWBH switchboard Equipment Instructions Details of instructions for equipment for use in the Incident Control Room can be found in the secure cupboards in each of the Incident Control Rooms Contact Lists Contact lists for the BCMG and potential BCMRT members are held centrally by the CCG On-call Director. 4.8 Documentation and Logging A Critical Incident decision log must be kept by the Incident Director, supported by trained Decision Loggists, as an accurate and contemporaneous record of the decisions and actions carried out during a Critical Incident. This should be done using the Decision Logs ('Red Books') held in each of the CCG's Incident Control Rooms (ICRs), which contain detailed best practice guidance regarding their use. The decision log should be cross-referenced to the ICR general log and personal logs where appropriate. A separate Critical Incident general log must be maintained within the ICR, overseen by the ICR Manager and using the NHS 'Green Books' held there to record dates and times of all relevant information given and received within the ICR, actions and all other communications relating to the incident, to be completed in line with the detailed guidance contained within copies of the 'Green Book'. All written documents, letters, memoranda and fax messages should be dated and time of receipt recorded, with cross-reference to the decision log and personal logs where appropriate. All staff involved should keep a personal log of their activities and actions throughout the incident using the template which can be found at Page 60 Section 6 of this Plan and in line with guidance contained therein. Personal logs should be cross-reference to the ICR general log and decision log wherever appropriate. All personal logs should be signed and dated and handed to the Incident Control Room (ICR) Manager at stand down. Version 1.2 July 2017 Page 24

32 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4 : C R I T I C A L I N C I D E N T R E S P O N S E The NHS regards all logs as the definitive legal record of an incident. All records must be kept secure by the CCG for a minimum of 25 years since they may be required as evidence in the event of a public enquiry or criminal prosecution. Following an incident being stood down, logs should be handed to the Chair of the CCG's Quality and Safety Committee for safekeeping. Details of trained loggists are held by the CCG Director On-call. 4.9 Communications Evidence from previous incidents demonstrates that effective communications can determine the success or failure of an incident response. To ensure effective communications are in place, the BCMG is responsible for: 1. Determining the outline communication to be received by staff, detailing the nature of the incident; 2. Setting strategic direction for communicating with stakeholders; and 3. Setting the top-line communications for media relations. All communication strategies should be developed in liaison with the CSU s Communications Team Communicating with Staff Initial communication with staff is vital to the successful continuation of critical and essential services, as it will require varying periods of time for the relevant Plans to be activated. Evidence from previous incidents demonstrates that staff who feel in the loop are happier to work as they understand the rationale behind such activity. As such, the BCMG should aim to ensure that any initial communication with staff includes the following information: What the incident is; What the cause of the Incident is or may have been (if known); How long the incident is likely to last; How the incident is to affect their work; What is expected of them during the course of the incident; and Confirmation of how communication should be maintained between them and the Manager Managing Stakeholders Version 1.2 July 2017 Page 25

33 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4 : C R I T I C A L I N C I D E N T R E S P O N S E Managing communications with stakeholders during an incident is essential. At a strategic level it is the role of the BCMG, in partnership with the CSU s Communications Team to decide which strategic level stakeholders need to be informed and what messages need to be given. Examples of stakeholders at a strategic level might include: GPs Acute Trusts, Mental Health Trusts and Foundation Trusts; NHS England West Midlands; and Local Authorities Working with the Media It is likely that an incident requiring activation of either Emergency or Business Continuity Plans will attract some media interest. The media can be proactively utilised during an incident and the media can be an effective way of reassuring and communicating with stakeholders and the public. Conversely, the media can also have a detrimental effect on the response. The BCMG, supported by the BCMRT, should work in conjunction with the CSU s Communications Team to develop the position of the CCG in relation to an incident and work to ensure that the appropriate messages are communicated Stand Down It is important following the end of an incident that an appropriate stand down message is communicated to officially end the incident and begin efforts to restore normality. The decision to stand down from a Critical Incident is made by the BCMG. It is essential that all people who were alerted to the incident are notified, including: 1. Staff; 2. The media; and 3. Stakeholders Debrief Following any incident in which the CCG's Business Continuity Plan has been employed it is essential that debrief arrangements are put into place to evaluate the response, develop lessons learned and ultimately develop action plans to improve the resilience of the organisation. Version 1.2 July 2017 Page 26

34 4 : C R I T I C A L I N C I D E N T R E S P O N S E 4 : C R I T I C A L I N C I D E N T R E S P O N S E The BCMG is responsible for ensuring that a debrief is carried out from a CCG-wide strategic perspective, including the operation of the BCMG itself. The BCMG is finally responsible for ensuring a report is compiled detailing the lessons learned from Departments and Directorates from across the CCG. Version 1.2 July 2017 Page 27

35 5 STAFF ACTION CARDS This Section includes generic action cards covering: a. CCG Incident Assessment Guidelines b. Incident Escalation Process c. Command and Control Arrangements Action cards have been developed for specific roles and responsibilities within the CCG's response to an incident: 1. Notifying Manager 2. CCG On-call Director / In Hours Designate 3. Accountable Emergency Officer / Nominated Deputy 4. Incident Director 5. Business Continuity Management Response Team roles 6. Directorate Director 7. Staff involved in Departmental response Version 1.2 July 2017 Page 28

36 Incident assessment guidelines Minor Business Continuity Incident Involves one Team/Department only and or Minor risk(s) e.g. criticality of service and/or Has little or no political/media interest and/or Incident is contained and can be managed using existing resources Managed through focussed application of day-to-day arrangements and resources Refer to appropriate CCG policies and if necessary to the relevant Team / Departmental detail contained within this Plan (See section 2.41) Significant Business Continuity Incident Involves one Directorate only and/or Significant risk(s) e.g. criticality of service and/or Significant local political/media interest and/or Incident can be managed with coordination of existing resources Managed through activation of appropriate Directorate Business Continuity Plan(s) Refer to appropriate CCG policies and to the relevant Directorate detail contained within this Plan (See Section 2.42) Critical Incident Standby / Response Involves more than one Directorate/has a CCG-wide organisational impact or beyond and/or Critical risk(s) e.g. criticality of service and/or Widespread political/media interest and/or Incident may require widespread coordination of existing resources and potential requirement for additional resources Managed through activation of the CCG-wide Business Continuity Plan or NHS England West Midlands Incident Response Plan as appropriate. Refer to appropriate CCG policies and to CCG-wide detail contained within this Plan (See Section 4) This is a guideline only. Each incident is dynamic and must be assessed and dealt with appropriately and proportionately on a case-by-case basis through the appropriate Impact and Risk Assessments. Escalation and de-escalation through the levels above can also take place as appropriate during the evolution and on-going management of an incident. Version 1.2 July 2017 Page 29

37 Incident escalation process INCIDENT OCCURS Confirm available details Department Manager (Notifying Manager) Minor Business Continuity Incident Significant Business Continuity Incident In-Hours Normal channels of communication should be used in the first instance. Out of Hours Contact the Black Country CCG Director On Call Via: SWBH switchboard Critical Incident Stanby /Response Accountable Emergency Officer NHS England West Midlands 1 st Oncall Incident Manager via: First Response Tel NHS England West Midlands Incident Response Plan Level 1 BUSINESS CONTINUITY MANAGEMENT GROUP (BCM GROUP) BUSINESS CONTINUITY MANAGEMENT RESPONSE TEAM (BCMRT) Consider NHS England West Midlands Incident Response Plan Levels 2-4 Version 1.2 July 2017 Page 30

38 CCG Critical Incident Command and Control Structure Business Continuity Management Group (BCMG) STRATEGIC - GOLD Business Continuity Management Response Team (BCMRT) TACTICAL - SILVER Directorate / Department /Service Level OPERATIONAL - BRONZE Version 1.2 July 2017 Page 31

39 Notifying Manager Your role Your location To act as the first point of contact in the event of any potential incident Incident progress is reported to you by You report on incident progress to and take direction from As determined by the incident Staff dealing with the incident as appropriate CCG On-call Director / In Hours Designate Actions and Responsibilities Commence your own Personal Log using the template at Section 6 of this Plan and log the call as the first entry Complete an initial Incident Report Form. Each risk identified should be fully recorded and evaluated using the Risk Assessment Template. Complete additional Incident Report Form(s) if further updates required, ensuring that revised/updated/additional Risk Assessment Templates are completed to ensure that the pattern of risk and mitigating measures are fully catalogued for the duration of the incident Determine and review Incident Level using CCG Incident Assessment Guidelines Oversee effective business continuity, ensure analysis and periodic dynamic review by of relevant service BIAs to identify and mitigate service impacts Decide whether to escalate to the CCG On-call Director / In Hours Designate Respond throughout in accordance with the relevant CCG policy or policies where applicable If no escalation is required Communicate with staff who reported the incident on how best to resolve the situation Ensure a local service manager is informed when possible and transfer management of the incident Close the log once management of the incident has been transferred If escalated to the CCG On-call Director / In Hours Designate Work closely with the CCG On-call Director / In Hours Designate to provide support where requested/directed by the CCG On-call Director / In Hours Designate Keeping Records Continue to log as appropriate Close the log when requested to do so or when the incident is stood down Health and Safety Assess the likelihood of the incident requiring you to continue responsibility for longer than 6 hours. If this is the case contact another Manager to take over responsibilities at an agreed time Version 1.2 July 2017 Page 32 Time Completed or N/A

40 Ensure Health and Safety regulations are adhered to by ALL staff dealing with the incident, including regular breaks and hand over to another member of staff Hand over as required to the next Manager, providing as comprehensive a handover as possible, including outstanding and discharged actions/issues Version 1.2 July 2017 Page 33

41 CCG On-call Director / In Hours Designate Your role Your location To coordinate the initial response to an incident on behalf of the CCG and to determine level of response. As determined by circumstances Incident progress is reported to you by You report on incident progress to Notifying Manager Accountable Emergency Officer Nominated Deputy Actions and Responsibilities Commence your own Personal Log using the template at Section 6 of this Plan and log the call as the first entry Time Completed or N/A Establish as comprehensive an initial incident brief as possible from the Notifying Manager and continue to liaise as necessary Complete an initial Incident Report Form. Each risk identified should be fully recorded and evaluated using the Risk Assessment Template. Complete additional Incident Report Form(s) if further updates required, ensuring that revised/updated/additional Risk Assessment Templates are completed to ensure that the pattern of risk and mitigating measures are fully catalogued for the duration of the incident Oversee effective business continuity, ensure analysis and periodic dynamic review by of relevant service BIAs to identify and mitigate service impacts Notify and liaise as appropriate with key CCG contractor/supplier functions on-call (e.g. estates, IT) Respond throughout in accordance with the relevant CCG policy or policies where applicable Undertake initial command of the CCG's response to the incident Determine Incident Level or Standby Incident Level using CCG Incident Assessment Guidelines Contact Accountable Emergency Officer and advise If requested to do so by the Accountable Emergency Officer / Nominated Deputy, contact and maintain on-going liaison with the NHS England West Midlands 1 st On-call Incident Manager If necessary, contact CSU Media and Communications representative to ensure a media strategy is in place as a priority If agreed, activate the CCG's Business Continuity Plan Hand over to the next On-call Director, providing as comprehensive a handover as possible, including outstanding and discharged actions and issues In the event of a Critical Incident declaration Decide what resources are immediately needed and the response required prior to the CCG Business Continuity Plan command and control Version 1.2 July 2017 Page 34

42 arrangements being in place Attend the Incident Control Room and brief the Incident Commander once appointed Hand over control of the CCG's response to the CCG Incident Director, providing as comprehensive a handover as possible to include a status report on outstanding and discharged actions and issues Version 1.2 July 2017 Page 35

43 Accountable Emergency Officer / Nominated Deputy Your role STRATEGIC To direct the overarching strategic response of the CCG immediately prior to and throughout following, the decision to declare a critical incident Your location Incident progress is reported to you by You report on incident progress to and take direction from As determined by circumstances CCG On-call Director / In Hours Designate Governing Body as appropriate Actions and Responsibilities Commence your own Personal Log using the template at Section 6 of this Plan and log the call as the first entry Time Completed or N/A Complete an initial Incident Report Form. Each risk identified should be fully recorded and evaluated using the Risk Assessment Template. Complete additional Incident Report Form(s) if further updates required, ensuring that revised/updated/additional Risk Assessment Templates are completed to ensure that the pattern of risk and mitigating measures are fully catalogued for the duration of the incident Maintain on-going dialogue with the CCG On-call Director / In Hours Designate as determined by the requirements of the incident Take ultimate responsibility for the decision to declare a critical incident In the event of a Critical Incident declaration Convene and attend the Business Continuity Management Group (BCMG) as appropriate Version 1.2 July 2017 Page 36

44 Incident Director Your role Your location Incident progress is reported to you by You report on incident progress to and take direction from You manage/supervise You are managed/supervised by STRATEGIC TACTICAL To provide overall strategic leadership in the response and recovery on behalf of the CCG Incident Control Room (ICR) Members of the Business Continuity Management Response Team (BCMRT) Business Continuity Management Group (BCMG) The ICR Manager and Advisers/Directorate representatives within the BCMRT Accountable Emergency Officer / Nominated Deputy Actions and Responsibilities Commence your own Personal Log using the template at Section 6 of this Plan Time Completed or N/A Respond throughout in accordance with the relevant CCG policy or policies where applicable Declare CCG incident status: Communicate this internally and to the NHS England West Midlands 1 st On-call Incident Manager at a minimum Incident Director Rota: Make arrangement for Incident Director rota if incident likely to last longer than 12hrs Appoint Business Continuity Management Response Team and ensure Action Cards are distributed In agreement with Incident Control Room Manager, ensure that: ALL ICR staff commence and maintain a personal log using the template at Section 6 of this Plan a single ICR chronological general log is started, supported by a cadre of trained general loggists, using the NHS 'Green Book' held in each ICR and that this constantly updated by ALL key personnel to maintain a record of key events, communications and actions a Decision Log, supported by a cadre of trained Decision Loggists, is commenced and maintained using the NHS 'Red Book' for all decisions taken by the Business Continuity Incident Management Group and Business Continuity Incident Response Team REMEMBER THESE ARE LEGAL DOCUMENTS AND MAY BE PRODUCED AT ANY FUTURE INQUIRIES/LEGAL PROCEEDINGS Ensure Incident Control Rooms are established and setup Organise Loggist cover for the first 48hrs and review periodically Version 1.2 July 2017 Page 37

45 Verify and gather information using the Incident Report form Risk Register: lead the risk assessment and cataloguing process ensuring risks and associated mitigating measures are logged on a central dynamic risk register and regularly reviewed Establish Battle Rhythm with NHS England West Midlands Develop a proportionate response in partnership with NHS England West Midlands Establish CCG-wide service criticality in consultation with BCMG members and ensure Business Continuity is in place for existing CCG services Supervise effective management: Hold regular meetings with the Business Continuity Incident Response Team and ensure ALL staff, including decision loggists and administrative staff, are fully briefed and have adequate direction / resources and handover Ensure Health and Safety regulations are adhered to by staff: Take regular breaks and hand over to another member of staff Assess and monitor responses Ensure plans are developed to support efficient recovery of services post incident Authorise and stand down from a critical incident Hand in all documentation kept to the Incident Control Room (ICR) Manager Put in place arrangements for a full debrief to be held Ensure a report is developed including lessons identified and an action plan for developing these to lessons learned Handover: provide the relief Incident Director with as comprehensive a handover as possible using the Incident Report Form, to include a status report on outstanding and discharged actions and issues Version 1.2 July 2017 Page 38

46 Incident Control Room Manager Your role Your location TACTICAL To ensure that the Incident Control Room (ICR) runs smoothly and effectively in support of the Incident Director and overall incident effort. The ICR Manager is responsible for all activity and staff within the ICR and must ensure staffing levels and resources are sufficient and that all personnel are supported, briefed and equipped to undertake their role. Incident progress is reported to you by You report on incident progress to and take direction from You manage/supervise You are managed/supervised by Incident Control Room (ICR). Members of the Business Continuity Management Response Team (BCMRT) Incident Director Administrative and support staff members of the Business Continuity Management Response Team (BCMRT) Incident Director Actions and Responsibilities Commence a Personal Log using the template log book at Section 6 of this Plan Ensure Incident Control Room is set up and functioning as soon as possible In collaboration with the Incident Director assign roles and allocate staff to ensure all key functions are covered. Dual roles may be required in the initial stages Mobilise sufficient Decision Loggists, General Loggists, minute takers and administrative support officers to allow efficient running of centre Brief Decision Loggists, General Loggists, minute takers and administrative support officers on specific requirements regarding their roles, including cross referencing requirements for decision, general and personal logs In agreement with Incident Director, ensure that: ALL ICR staff commence and maintain a personal log using the template at Section 6 of this Plan A single ICR chronological general log is started, supported by a cadre of trained general loggists, using the NHS 'Green Book' held in each ICR and that this constantly updated by ALL key personnel to maintain a record of key events, communications and actions A Decision Log, supported by a cadre of trained Decision Loggists, is commenced and maintained using the NHS 'Red Book' for all decisions taken by the Business Continuity Incident Management Group and Business Version 1.2 July 2017 Page 39 Time Completed or N/A

47 Continuity Incident Response Team REMEMBER THESE ARE LEGAL DOCUMENTS AND MAY BE PRODUCED AT ANY FUTURE INQUIRIES/LEGAL PROCEEDINGS Ensure Health, Safety and Welfare of all ICR staff Ensure contact with other control rooms as necessary Ensure all teleconferences are organised as directed by the Director If incident is likely to be protracted, develop staff rota to cover key positions for first three (3) days in first instance Ensure effective handover/briefing for ALL staff commencing shift, including Decision Loggist and administrative support Stand down from a critical incident when instructed to do so by the Incident Director, ensuring stand down of ICR staff you manage Collect ALL Decision Logs, General Log and Personal Logs from EVERYONE involved in the Critical Incident response and ensure that these are handed to the Chair of the Trust Business Continuity & Emergency Preparedness Group who will ensure that appropriate arrangements are made for these to be retained by the Trust for a minimum of 25 years Version 1.2 July 2017 Page 40

48 Decision Loggist Your role Your location You are managed/supervised by TACTICAL To capture fully all of the decisions as instructed by the incident Director and agree them with him or her as a factual account of what has happened. To be located within the Incident Control Room (ICR) or with Director at all times outside of the ICR. Incident Control Room (ICR) Manager DO NOT COMMENCE YOUR SHIFT unless you are satisfied you have received a full and sufficient briefing and/or handover - this will be organised on your behalf by the ICR Manager Actions and Responsibilities Commence your own Personal Log using the template at Section 6 of this Plan Time Completed or N/A Decision Log - all decisions and justifications taken by the Business Continuity Incident Management Group and Business Continuity Incident Response Team MUST be logged using the NHS 'Red Book' held within each Incident Control Room (ICR) Ensure that all decisions taken have a supporting justification/rationale recorded in the decision log Shadow the Incident Director for the duration of the shift ensuring that all breaks are covered by another decision loggist Attend all meetings and teleconferences with Incident Director Hand over to the next appointed Decision Loggist as required by the Incident Control Room (ICR) Manager Stand down from a critical incident when instructed to do so Close Decision log at stand down, returning the log to the Incident Control Room Manager Version 1.2 July 2017 Page 41

49 General Loggist Your role Your location You are managed/supervised by TACTICAL To capture fully details for the Incident Control Room (ICR) chronological general log as instructed by the incident Director and Incident Control Room Manager and agree with him or her the log as a factual account of what has happened. To be located within the Incident Control Room (ICR) or with Director at all times outside of the ICR. Incident Control Room (ICR) Manager DO NOT COMMENCE YOUR SHIFT unless you are satisfied you have received a full and sufficient briefing and/or handover - this will be organised on your behalf by the ICR Manager Actions and Responsibilities Commence your own Personal Log using the template at Section 6 of this Plan Time Completed or N/A Chronological General Log - all events, communications and actions MUST be logged using the NHS 'Green Book' held within each Incident Control Room (ICR) and cross referred with the 'Red Book' decision log wherever appropriate Hand over to the next appointed General Loggist as required by the Incident Control Room (ICR) Manager Stand down from a critical incident when instructed to do so Close 'Green Book' general log at stand down, returning the log to the Incident Control Room Manager Version 1.2 July 2017 Page 42

50 Minute Taker and Administrative Support Your role Your location You are managed/supervised by TACTICAL To provide administrative and secretarial support within the Incident Control Room environment as directed by the Incident Control Room Manager Incident Control Room (ICR) Incident Control Room (ICR) Manager Actions and Responsibilities Commence a Personal Log using the template log book provided at Section 6 of this Plan Support managers/advisers within the Incident Control Room under the direction of the Incident Control Room (ICR) Manager Take and transcribe minutes of all management team meetings and teleconferences (meetings will be allocated by the Incident Control Room Manager) Produce and circulate agendas for each meeting Provide routine call handling Assist in preparation of time critical documents Other duties as required/requested Stand down from a critical incident when instructed to do so Close your personal log at stand down, returning your log to the Incident Control Room Manager Time Completed or N/A Version 1.2 July 2017 Page 43

51 CCG Directorate Director Your role Your location STRATEGIC TACTICAL To assist the BCMG in the development of strategy for the response to and recovery from an incident. Incident progress is reported to you by You report on incident progress to and take direction from You manage/supervise You are managed/supervised by Business Continuity Management Group (BCMG), Incident Control Room (ICR) and/or within Directorate Business Continuity Management Team (BCMRT) members Business Continuity Management Group (BCMG), Accountable Emergency Officer/Nominated Deputy Directorate staff according to normal business Accountable Emergency Officer/Nominated Deputy Actions and Responsibilities Commence a Personal Log using the template log book provided at Section 6 of this Plan Find out your immediate and potential future roles in managing the incident i.e. as a member of the BCMG or as Incident Director and attend as appropriate Respond throughout in accordance with the relevant CCG policy or policies where applicable Instruct your Directorate Management representative within the ICR to obtain the Directorate Management Representative Action Card from the Business Continuity Plan Keep Records Continue to log as appropriate Close the log when requested to do so or when the incident is stood down. Ensure that your completed log is handed to the Incident Control Room Manager. Time Completed or N/A Version 1.2 July 2017 Page 44

52 Communications and Media Advisor Your role Your location TACTICAL To Provide Senior Level Communication Co-ordination, Advice and Support Incident progress is reported to you by You report on incident progress to and take direction from You are managed/supervised by Incident Control Room (ICR). Communications Team staff Incident Director Incident Director Actions and Responsibilities Commence Personal Log: commence a log for all your decisions, associated justifications using the log book template at Section 6 of this Plan Rapidly formulate, communicate and implement an integrated media policy (for the CCG and with other partners) on behalf of the Incident Director Liaise with the NHS England communications manager as appropriate and necessary Deal with all media/press enquiries Be responsible for organising press conferences and interviews as appropriate Be responsible for providing staff briefings for those not involved in the management of the incident Prepare press statements Assist in the production of on-going updates for the Incident Director providing an overview of media content regarding the incident and CCG response/impacts Ensure a briefing is received from the Incident Director Ensure risks associated with poor communication that may impact through loss of confidence or in other adverse ways are logged on the risk register or as risks within the general log Provide an update on issues relation to communications at BCMRT Incident meetings Decide battle rhythm, ensuring so far as is reasonably practicable the Incident Director is aware of the media timetable to avoid/not miss significant broadcasts Log all requests for media appearances and decisions taken by the Incident Director in relation to warning, informing or instructing the pubic; prepared press statements, staff briefings and Frequently Asked Questions (FAQs) Time Completed or N/A Version 1.2 July 2017 Page 45

53 Ensure the Incident Director is aware of the person chosen to act as the public face of the CCG and undertake media interviews Consider mutual aid requirements where communications staff become overwhelmed by media requests Consider communications needs during the recovery period and feed into strategy development as appropriate Provide the relief CCG Communications Advisor with as comprehensive a handover as possible to include a status report on outstanding and discharged actions and issues. Ensure all breaks are appropriately covered and sign-on and sign-off of the log before and after commencing duties/shift Stand down from a critical incident when instructed to do so by the Incident Director Close personal log at stand down, returning your log to the Incident Control Room Manager Version 1.2 July 2017 Page 46

54 Estates and Facilities Advisor Your role Your location PROVIDED BY NHS PROPERTY SERVICES TACTICAL To provide advice and support to the Incident Director which is informed by established CCG policies and procedures in respect of the CCG estates and facilities Incident progress is reported to you by You report on incident progress to and take direction from You are managed/supervised by Incident Control Room (ICR) Estates and Facilities staff Incident Director Incident Director Actions and Responsibilities Commence Personal Log: commence a log for all your decisions, associated justifications using the log book template at Section 6 of this Plan Time Completed or N/A Advise on the development of strategies and ensure implementation of strategies once agreed: provide an assessment of the impact of strategies under development on the CCG estates and facilities, considering a range of supportive options. Ensure that agreed strategies are implemented and monitor as appropriate Risk Register: consider and advise on the potential impact of the incident on the CCG estate and facilities Communicate: Assist the Incident Director in preparing statements for Department of Health and others Media: ensure consistent messages are given to the public Assist in the development and implementation of strategies to achieve efficient service recovery as required Handover: provide the relief Estates and Facilities Advisor with as comprehensive a handover as possible to include a status report on outstanding and discharged actions and issues. Ensure all breaks are appropriately covered and sign-on and sign-off of the log before and after commencing duties/shift. It may be useful to use the above list of actions and any logs kept as a guide Stand down from a critical incident when instructed to do so by the Incident Director Close personal log at stand down, returning your log to the Incident Control Room Manager Version 1.2 July 2017 Page 47

55 Finance Advisor Your role Your location TACTICAL To provide advice and support to the Incident Director which is informed by established CCG policies and procedures in respect of expenditure and current levels of financial resources Incident progress is reported to you by You report on incident progress to and take direction from You are managed/supervised by Incident Control Room (ICR) Finance staff Incident Director Incident Director Actions and Responsibilities Commence Personal Log: commence a log for all your decisions, associated justifications using the log book template at Section 6 of this Plan Advise on the development of strategies and ensure implementation of strategies once agreed: provide an assessment of the financial impact of strategies under development, considering a range of supportive options. Ensure that agreed strategies are implemented and monitor as appropriate Risk Register: consider and advise on the potential financial impact of the incident Resources: advice the Incident Director in relation to the level of resources available and log all financial expenditure and commitments Communicate: Assist the Incident Director in preparing financial statements for Department of Health and others Media: ensure consistent messages are given to the public Assist in the development and implementation of strategies to achieve efficient service recovery as required Handover: provide the relief Financial Advisor with as comprehensive a handover as possible to include a status report on outstanding and discharged actions and issues. Ensure all breaks are appropriately covered and sign-on and sign-off of the log before and after commencing duties/shift. It may be useful to use the above list of actions and any logs kept as a guide. Stand down from a critical incident when instructed to do so by the Incident Director Close personal log at stand down, returning your log to the Incident Control Room Manager Time Completed or N/A Version 1.2 July 2017 Page 48

56 Human Resources and Workforce Advisor Your role Your location TACTICAL To provide advice and support to the Incident Director which is informed by established CCG policies and procedures in respect of the CCG's human resources and workforce Incident progress is reported to you by You report on incident progress to and take direction from You are managed/supervised by Incident Control Room Human Resources and Workforce staff Incident Director Incident Director Actions and Responsibilities Commence Personal Log: commence a log for all your decisions, associated justifications using the log book template at Section 6 of this Plan Advise on the development of strategies and ensure implementation of strategies once agreed: provide an assessment of the impact of strategies under development on the CCG's human resources and workforce, considering a range of supportive options. Ensure that agreed strategies are implemented and monitor as appropriate Risk Register: consider and advise on the potential impact of the incident on the CCG's human resources and workforce Communicate: Assist the Director in preparing statements for Department of Health and others Media: ensure consistent messages are given to the public Assist in the development and implementation of strategies to achieve efficient service recovery as required Handover: provide the relief Human Resources and Workforce Advisor with as comprehensive a handover as possible to include a status report on outstanding and discharged actions and issues. Ensure all breaks are appropriately covered and sign-on and sign-off of the log before and after commencing duties/shift. It may be useful to use the above list of actions and any logs kept as a guide Stand down from a critical incident when instructed to do so by the Incident Director Close personal log at stand down, returning your log to the Incident Control Room Manager Time Completed or N/A Version 1.2 July 2017 Page 49

57 PROVIDED THROUGH IT SERVICES PROVIDER IT and Telecommunications Advisor Your role Your location TACTICAL To provide advice and support to the Incident Director which is informed by established CCG policies and procedures in respect of the CCG's information technology and telecommunications Incident progress is reported to you by You report on incident progress to and take direction from You are managed/supervised by Incident Control Room (ICR) IT and Telecommunications staff Incident Director Incident Director Actions and Responsibilities Commence Personal Log: commence a log for all your decisions, associated justifications using the log book template at Section 6 of this Plan Time Completed or N/A Advise on the development of strategies and ensure implementation of strategies once agreed: provide an assessment of the impact of strategies under development on the CCG's information technology and telecommunications, considering a range of supportive options. Ensure that agreed strategies are implemented and monitor as appropriate Risk Register: consider and advise on the potential impact of the incident on the CCG's information technology and telecommunications Communicate: Assist the Incident Director in preparing statements for Department of Health and others Media: ensure consistent messages are given to the public Assist in the development and implementation of strategies to achieve efficient service recovery as required Handover: provide the relief Information Technology and Telecommunications Advisor with as comprehensive a handover as possible to include a status report on outstanding and discharged actions and issues. Ensure all breaks are appropriately covered and sign-on and sign-off of the log before and after commencing duties/shift. It may be useful to use the above list of actions and any logs kept as a guide. Ensure closure of personal log Stand down from a critical incident when instructed to do so by the Incident Director Close personal log at stand down, returning your log to the Incident Control Room Manager Version 1.2 July 2017 Page 50

58 Legal Advisor Your role Your location TACTICAL To provide advice and support to the Incident Director which is informed by established CCG policies and procedures on all matters of law Incident progress is reported to you by You report on incident progress to and take direction from You are managed/supervised by Incident Control Room (ICR) Legal staff Incident Director Incident Director Actions and Responsibilities Commence Personal Log: commence a log for all your decisions, associated justifications using the log book template at Section 6 of this Plan Advise on the development of strategies and ensure implementation of strategies once agreed: provide an assessment of the legal implications of strategies under development, considering a range of supportive options. Ensure that agreed strategies are implemented and monitor as appropriate Risk Register: consider and advise on the potential legal impact of the incident Communicate: Assist the Incident Director in preparing statements for Department of Health and others as instructed or appropriate Media: ensure the legal dimension of public messages are given due consideration Assist in the development and implementation of strategies to achieve efficient service recovery as required Handover: provide the relief Legal Advisor with as comprehensive a handover as possible to include a status report on outstanding and discharged actions and issues. Ensure all breaks are appropriately covered and sign-on and sign-off of the log before and after commencing duties/shift. It may be useful to use the above list of actions and any logs kept as a guide Stand down from a critical incident when instructed to do so by the Incident Director Close personal log at stand down, returning your log to the Incident Control Room Manager Time Completed or N/A Version 1.2 July 2017 Page 51

59 PROVIDED BY IT SERVICES PROVIDER Technical Support IT and Telecomms Your role Your location You are managed/supervised by TACTICAL To provide staff within the Incident Control Room with timely and appropriate IT and telecommunications support Incident Control Room (ICR) Incident Control Room (ICR) Manager Actions and Responsibilities Time Completed or N/A To provide support as required in relation to i. IT systems ii. Data capture and access iii. iv. Telecoms Software usage v. Equipment procurement/replacements Version 1.2 July 2017 Page 52

60 Staff involved in Directorate response Your role Your location OPERATIONAL To support and provide the operational response and recovery under the direction of the Departmental/Directorate Manager. Incident progress is reported to you by You report on incident progress to and take direction from You manage/supervise You are managed/supervised by Within Directorate as appropriate Departmental/Directorate staff in accordance with normal reporting lines Directorate Management representative within the Incident Control Room (ICR) In line with normal management arrangements Normal management arrangements Actions and Responsibilities Respond throughout in accordance with the relevant CCG policy or policies wherever applicable. Time Completed or N/A Act as appropriate in accordance with requests and instructions received from your Directorate Management representative in the Incident Control Room (ICR). Communicate with your staff and other staff the details of the incident as necessary. Assist in the implementation of strategies to achieve efficient service recovery as required. Keep Records If requested to do so, obtain a log book from the Business Continuity Plan and complete as necessary. Forward the log to the Incident Control Room Manager once the Incident has been closed or you are no longer required. Version 1.2 July 2017 Page 53

61 6 : F O R M S A N D T E M P L A T E S 6 : F O R M S A N D T E M P L A T E S 6 FORMS AND TEMPLATES Version 1.2 July 2017 Page 54

62 Incident Report Form Form completed by Reporting Unit Date of initial call Call made by Time of initial call Return tel no This is Incident Report Form Number (1, 2 etc) Incident for this Incident Report at Date: Time: Brief description of incident Further specific information (the following prompts are guidelines only) WHERE THIS IS A FOLLOW ON REPORT AND THERE IS NO CHANGE SINCE LAST REPORT PLEASE ANNOTATE THE APPROPRIATE SECTION 'AS LAST REPORT' Exact location of the incident? Which Team(s)/Department(s) are currently involved? Which Directorate(s) are currently involved? Further specific information continued Version 1.2 July 2017 Page 55

63 Are there any hazards to patients, staff, responders or to members of the public? Have any external agencies (e.g. emergency services, other NHS organisations) been notified? What are the current risks, if any, to services? Are there any reputational risks to the CCG? What is the current or anticipated future level of media interest (local/regional/national)? Is the incident likely to invoke political interest (local/regional/national)? Any other relevant information? Version 1.2 July 2017 Page 56

64 Description of advice given / action taken / decisions made Follow-up Incident Report Form to be completed? YES / NO Escalate? YES / NO Record rationale for escalation below: De-escalate? YES / NO Record rationale for de-escalation below: Signature: Date completed: Time completed: Version 1.2 July 2017 Page 57

65 Level of Consequence Use one template for each risk This is template number Completed by (name). Description of risk of Incident Risk Assessment Template Level of Risk = Likelihood x Consequence Catastrophic Major Moderate Minor Negligible Rate the described risk (Likelihood x Consequence = Final Score) Likelihood Consequence Final Score/Level of Risk Detail controls for this risk that are already in place (if any) Rare Unlikely Possible Likely Likelihood of Occurrence (Impact or Severity) KEY KEY KEY KEY Range 8 Range (Low) (Moderate) Acceptable Unacceptable risks risks Range (High) Unacceptable risks Almost Certain Range 1 4 (Very Low) Minor acceptable risks List and number further actions required to reduce the risk Actions allocated to (indicate number if multiple individuals) Deadline for actions to be competed Version 1.2 July 2017 Page 58

66 Standard First Agenda for Business Continuity Management Group (BCMG) 1. Welcome 1.1 Chair Person 1.2 Deputy Chair Person 2. Logging the Incident 3. Incident Brief See Incident Report Form 3.1 Nature of Incident 3.2 Exact Location 3.3 Current known impact 4. Consideration of the CCG's Strategic Aim and Objectives 5. Incident Risk Assessment 6. Communication Requirements 8.1 Staff 8.2 Stakeholders 8.3 The Media 7. Incident Declaration 8. Plan Activation 9. Confirm Command and Control arrangements 9.1 Set requirement for Directorate Impact Assessments to be completed and returned to BCMRT 10 Distribute Action Cards 11. Date and Time of Next Meeting: to be agreed Version 1.2 July 2017 Page 59

67 This log-book represents a note of key actions, decisions communications and assumptions made by the designated officer identified on the front of this document. It is not a verbatim transcript of that officer s time in post. Emergency Personal Log Book ROLE TO WHICH THIS LOG REFERS: NAME OF THE PERSON PERFORMING THE ROLE: This log-book started: BY (Print Name) DATE TIME Basic description of initiating incident: Log-book URN: Log-book of Version 1.2 July 2017 Page 60